Re: syscall arguments in audit records

Some of the system call arguments have useful information; they're not just pointing to a memory address. Some are necessary in order to determine what syscall was performed. For IPC syscalls, a0 indicates which of the IPC calls was executed. -debbie tinytim(a)us.ltcfwd .linux.ibm.com Sent by: To linux-audit-bounc linux-audit(a)redhat.com es(a)redhat.com cc Subject 03/25/2005 03:32 syscall arguments in audit records PM Please respond to Linux Audit Discussion System call arguments are pretty useless unless you're in a process where the memory addresses are still valid (like a testcase). Would it be useful to put an option in at a later date that allows you to dump arguments as human readable? -tim -- Linux-audit mailing list Linux-audit(a)redhat.com http://www.redhat.com/mailman/listinfo/linux-audit